does this assume a maximum of one malicious bookkeeper?

Yes, you need 3f+1, so 4 for f=1, 7 for f=2.

https://lamport.azurewebsites.net/pubs/byz.pdf